Analysis Overview
SHA256
d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6
Threat Level: Known bad
The file file.exe was found to be: Known bad.
Malicious Activity Summary
RedLine
PureCrypter
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Checks computer location settings
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-01-13 21:43
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-01-13 21:43
Reported
2023-01-13 21:45
Platform
win7-20221111-en
Max time kernel
155s
Max time network
168s
Command Line
Signatures
PureCrypter
RedLine
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 872 set thread context of 1676 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | buffetdetalhes.com | udp |
| N/A | 188.114.97.0:443 | buffetdetalhes.com | tcp |
| N/A | 45.142.214.214:20301 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
| MD5 | b0c7de14111c40f664432150255e9f86 |
| SHA1 | c54bdb6dc8821d820aad092dfd591fd9ec8ecf49 |
| SHA256 | 09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115 |
| SHA512 | fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf |
memory/872-54-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
| MD5 | b0c7de14111c40f664432150255e9f86 |
| SHA1 | c54bdb6dc8821d820aad092dfd591fd9ec8ecf49 |
| SHA256 | 09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115 |
| SHA512 | fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf |
memory/872-57-0x0000000000250000-0x0000000000274000-memory.dmp
memory/872-58-0x0000000074ED1000-0x0000000074ED3000-memory.dmp
memory/872-59-0x0000000005B40000-0x0000000005C14000-memory.dmp
memory/872-60-0x0000000004D30000-0x0000000004D7A000-memory.dmp
memory/872-61-0x0000000005090000-0x0000000005122000-memory.dmp
memory/1852-62-0x0000000000000000-mapping.dmp
memory/1852-64-0x000000006DA20000-0x000000006DFCB000-memory.dmp
memory/1852-65-0x000000006DA20000-0x000000006DFCB000-memory.dmp
memory/1852-66-0x000000006DA20000-0x000000006DFCB000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
| MD5 | b0c7de14111c40f664432150255e9f86 |
| SHA1 | c54bdb6dc8821d820aad092dfd591fd9ec8ecf49 |
| SHA256 | 09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115 |
| SHA512 | fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf |
memory/1676-68-0x0000000000400000-0x0000000000432000-memory.dmp
memory/1676-71-0x0000000000400000-0x0000000000432000-memory.dmp
memory/1676-73-0x0000000000400000-0x0000000000432000-memory.dmp
memory/1676-69-0x0000000000400000-0x0000000000432000-memory.dmp
memory/1676-75-0x000000000041B5CA-mapping.dmp
memory/1676-74-0x0000000000400000-0x0000000000432000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
| MD5 | b0c7de14111c40f664432150255e9f86 |
| SHA1 | c54bdb6dc8821d820aad092dfd591fd9ec8ecf49 |
| SHA256 | 09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115 |
| SHA512 | fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf |
memory/1676-78-0x0000000000400000-0x0000000000432000-memory.dmp
memory/1676-80-0x0000000000400000-0x0000000000432000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-01-13 21:43
Reported
2023-01-13 21:45
Platform
win10v2004-20221111-en
Max time kernel
149s
Max time network
155s
Command Line
Signatures
PureCrypter
RedLine
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1904 set thread context of 4380 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
Network
| Country | Destination | Domain | Proto |
| N/A | 93.184.221.240:80 | tcp | |
| N/A | 104.80.225.205:443 | tcp | |
| N/A | 8.8.8.8:53 | buffetdetalhes.com | udp |
| N/A | 188.114.97.0:443 | buffetdetalhes.com | tcp |
| N/A | 20.189.173.12:443 | tcp | |
| N/A | 87.248.202.1:80 | tcp | |
| N/A | 87.248.202.1:80 | tcp | |
| N/A | 87.248.202.1:80 | tcp |
Files
memory/1904-132-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
| MD5 | b0c7de14111c40f664432150255e9f86 |
| SHA1 | c54bdb6dc8821d820aad092dfd591fd9ec8ecf49 |
| SHA256 | 09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115 |
| SHA512 | fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
| MD5 | b0c7de14111c40f664432150255e9f86 |
| SHA1 | c54bdb6dc8821d820aad092dfd591fd9ec8ecf49 |
| SHA256 | 09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115 |
| SHA512 | fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf |
memory/1904-135-0x0000000000C30000-0x0000000000C54000-memory.dmp
memory/1904-136-0x0000000005C60000-0x0000000006204000-memory.dmp
memory/1904-137-0x00000000055F0000-0x0000000005682000-memory.dmp
memory/1904-138-0x00000000057B0000-0x00000000057BA000-memory.dmp
memory/1904-139-0x0000000006C80000-0x0000000006CD0000-memory.dmp
memory/1904-140-0x0000000006EF0000-0x0000000006FA2000-memory.dmp
memory/1904-141-0x00000000072E0000-0x0000000007302000-memory.dmp
memory/2496-142-0x0000000000000000-mapping.dmp
memory/2496-143-0x0000000002AF0000-0x0000000002B26000-memory.dmp
memory/2496-144-0x0000000005350000-0x0000000005978000-memory.dmp
memory/2496-145-0x00000000059F0000-0x0000000005A56000-memory.dmp
memory/2496-146-0x0000000005A60000-0x0000000005AC6000-memory.dmp
memory/2496-147-0x00000000060C0000-0x00000000060DE000-memory.dmp
memory/2496-148-0x0000000007700000-0x0000000007D7A000-memory.dmp
memory/2496-149-0x00000000065C0000-0x00000000065DA000-memory.dmp
memory/3572-150-0x0000000000000000-mapping.dmp
memory/4380-152-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
| MD5 | f0d621207b3805f4101ee9eae0f02a1c |
| SHA1 | f9eb653326a93e608e42800cc874a897f5a95ffa |
| SHA256 | 613f6ccc32fa32590acf90815597439cded663f951a87891d54d4078b7e37f18 |
| SHA512 | b2910373c9fb6c36064bd4461eeb1ab557223c1dd572d8c712a4576074422c9e871e98941cfe100d40eae57e38c3e43a37ffd4a6a11021eabe9485d8ee3c57a1 |
memory/4380-153-0x0000000000400000-0x0000000000432000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
| MD5 | 04a4105ad93a2ea565e46da45793ac6a |
| SHA1 | 913926a0c985c7777bbd0e751e9fe3ed2208a0b4 |
| SHA256 | 49e99ba25608615607d01de6651bc72d5daaf875150aa053b006e83383f4993e |
| SHA512 | 3cc837718882849f8f0a568f37917cde7a78b3d443cc47c7c52bcbacd012fd3b919cfca7b89eb3f425ae4936c852870f01618ba1baa1edd9717df83fb9683282 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ifmedianov.exe.log
| MD5 | 2e49a0dc2cc777cf418322c4466c896e |
| SHA1 | d1c48311da63a8124b58ca948b0d64409e927d2d |
| SHA256 | b6e3216891c905bc01dfa776fb8f50aadd5b51b997551eb32ad5e21a53574041 |
| SHA512 | b03923994a5b5b0c8ea0905a19a820eda810ded3687e965ee280641eb6b9dd8bf36ce3984bb04712199fcaffc28cacbbadcc872e12b2bda7f491091aa656156a |